Check for overflows when setting time and allow a time of -1.

diff --git a/src/certtool-args.def b/src/certtool-args.def
index 36f0629b0d95bbba312287e308f05f03fc77b0a1..bd512a51b593f7b23bc4c9f556d29e10b7992e7c 100644 (file)
--- a/src/certtool-args.def
+++ b/src/certtool-args.def
@@ -579,6 +579,7 @@ cn = "Cindy Lauper"
 serial = 007
 
 # In how many days, counting from today, this certificate will expire.
+# Use -1 if there is no expiration date.
 expiration_days = 700
 
 # X.509 v3 extensions

diff --git a/src/certtool-cfg.c b/src/certtool-cfg.c
index da95738d966271e218780c4cc892bab84ad1a10e..747c4b7986df7e1736bce427e77848c4274f2129 100644 (file)
--- a/src/certtool-cfg.c
+++ b/src/certtool-cfg.c
@@ -842,7 +842,7 @@ int get_days(void)
        int days;
 
        if (batch) {
-               if (cfg.expiration_days <= 0)
+               if (cfg.expiration_days == 0 || cfg.expiration_days < -2)
                        return 365;
                else
                        return cfg.expiration_days;

diff --git a/src/certtool.c b/src/certtool.c
index 9f0c74443f9a8a8af9939043294e8297a9d6b29c..83a25491b3a9cea16f25f924219b1c48387ddcb0 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -38,6 +38,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
+#include <intprops.h>
 
 /* Gnulib portability files. */
 #include <read-file.h>
@@ -328,17 +329,28 @@ generate_certificate(gnutls_privkey_t * ret_key,
        if (!batch)
                fprintf(stderr, "\n\nActivation/Expiration time.\n");
 
-       gnutls_x509_crt_set_activation_time(crt, time(NULL));
-
        now = time(NULL);
 
-       do {
-               days = get_days();
-               secs = days * 24 * 60 * 60 + now;
-       }
-       while (secs < now
-              || (unsigned) (secs - now) / (24 * 60 * 60) !=
-              (unsigned) days);
+       gnutls_x509_crt_set_activation_time(crt, now);
+
+       days = get_days();
+       secs = days;
+
+       if (secs != (time_t)-1) {
+               if (INT_MULTIPLY_OVERFLOW(secs, 24*60*60)) {
+                       secs = -1;
+               } else {
+                       secs *= 24*60*60;
+               }
+        }
+
+       if (secs != (time_t)-1) {
+               if (INT_ADD_OVERFLOW(secs, now)) {
+                       secs = -1;
+               } else {
+                       secs += now;
+               }
+        }
 
        result = gnutls_x509_crt_set_expiration_time(crt, secs);
        if (result < 0) {